Tag: MACOS

ClickFix Widely Adopted by Cybercriminals, APT Groups
Summary: Since August 2024, state-sponsored hackers and cybercriminals have been using a technique called ClickFix to deploy information stealer malware. This method involves social engineering through malicious JavaScript that manipulates users into executing harmful commands. Group-IB reports an increase in this attack vector, particularly targeting users on various platforms that offer free content or software.…
Read More
North Korea’s ScarCruft Deploys KoSpy Malware, Spying on Android Users via Fake Utility Apps
Summary: A North Korean threat actor, ScarCruft, has developed an Android surveillance tool called KoSpy that targets Korean and English-speaking users through deceptive apps on the Google Play Store. Additionally, a series of npm packages linked to another North Korean campaign are designed to deploy malware and steal sensitive information.…
Read More
Ramadan Scams on the Rise: Fake Giveaways, Crypto Traps & Fraudulent Donations | CloudSEK
This report highlights the rise of Ramadan-related cyber scams, particularly targeting charitable contributions and crypto investments. Cybercriminals are exploiting the goodwill associated with Ramadan to spread fraudulent schemes, often using social engineering tactics to deceive victims. Understanding these scams is essential for safeguarding against potential losses.…
Read More
Enhanced XCSSET Malware Targets MacOS Users with Advanced Obfuscation
Summary: Microsoft Threat Intelligence has identified a new variant of XCSSET malware targeting macOS developers, featuring advanced obfuscation, updated persistence techniques, and new infection strategies. The malware exploits the collaborative nature of Xcode projects, employing a four-stage infection chain that makes it difficult to detect. Although currently observed in limited attacks, its capabilities pose a significant threat to developers and users of macOS systems.…
Read More
Beware! Hacker Group Lazarus Deploys Malware Packages on npm Platform; SolarWinds Helpdesk Vulnerability Exposed: Attackers Can Decrypt Sensitive Passwords – Security Bull
A recent security report highlights multiple cyber threats, including the discovery of six malicious npm packages linked to the Lazarus hacker group, which are designed to steal sensitive credentials and deploy malware. Additionally, a serious vulnerability in SolarWinds’ web help desk has been uncovered, allowing attackers to decrypt sensitive credentials.…
Read More
Apple Releases Patch for WebKit Zero-Day Vulnerability Exploited in Targeted Attacks
Summary: Apple has released a security update addressing a zero-day vulnerability (CVE-2025-24201) in the WebKit engine, which has been exploited in sophisticated attacks targeting specific individuals. The update includes enhanced checks to prevent unauthorized actions and is applicable to various devices and operating system versions. This is the third actively exploited zero-day resolved by Apple this year.…
Read More
5 Common Evasion Techniques in Malware 
Cybercriminals continuously evolve their evasion techniques to bypass detection from security systems, making it increasingly difficult for security teams to respond to threats. This article examines common evasion tactics used by attackers, such as steganography, tool modification, and script obfuscation, detailing how these methods obscure malicious activities.…
Read More
North Korean Lazarus hackers infect hundreds via npm packages
Summary: Six malicious npm packages linked to the North Korean hacking group Lazarus have been discovered, designed to steal credentials and extract sensitive information. These packages, which have been downloaded 330 times, employ typosquatting tactics to mislead developers into installing them. Their malicious capabilities include the installation of backdoors and targeted cryptocurrency wallet thefts.…
Read More
Microsoft replacing Remote Desktop app with Windows App in May
Summary: Microsoft will discontinue support for the Remote Desktop app from the Microsoft Store on May 27, 2023, and recommends users transition to its new Windows App, which has been available since September 2024. Users are advised to utilize the built-in Remote Desktop Connection app for connecting to Remote Desktop Services until support is integrated into the new app.…
Read More
Fortinet Identifies Malicious Packages in the Wild: Insights and Trends from November 2024 Onward
FortiGuard Labs has tracked various malicious software packages since November 2024, highlighting a range of techniques used by attackers to exploit system vulnerabilities. The analysis reveals tactics such as low-file-count packages, suspicious install scripts, and command-and-control communication methods, showcasing the malicious intent concealed within software installations.…
Read More
RST TI Report Digest: 10 Mar 2025
This week’s threat intelligence report reveals a range of sophisticated cyber threats, including targeted multistage malware attacks, ransomware groups adopting new backconnect malware, and social engineering tactics employed in recruitment scams. Notable threats included a campaign targeting aviation and transport in the UAE, while other malware leveraged social media for distribution.…
Read More
Safe{Wallet} Confirms North Korean TraderTraitor Hackers Stole .5 Billion in Bybit Heist
Summary: Safe{Wallet} disclosed details about a sophisticated cyberattack on Bybit, attributed to state-sponsored North Korean hackers. The attackers employed advanced social engineering techniques to compromise a developer’s machine and hijack AWS session tokens, enabling them to conduct covert operations. The incident highlights serious security vulnerabilities in the cryptocurrency industry, which faces record losses from hacks in 2025.…
Read More
Unmasking the new persistent attacks on Japan
Cisco Talos discovered a malicious campaign attributed to an unknown attacker targeting organizations in Japan since January 2025, primarily exploiting the CVE-2024-4577 vulnerability to gain initial access and deploy advanced adversarial tools via Cobalt Strike. The attacker’s activities entail credential theft, system compromise, and potential lateral movement which could impact various industries.…
Read More